Tenda i3 Stack-Based Buffer Overflow Vulnerability in WifiMacFilterGet Function

A stack-based buffer overflow vulnerability has been identified in the Tenda i3 router, specifically in version 1.0.0.6(2204). The issue arises in the formWifiMacFilterGet function within the file /goform/WifiMacFilterGet. The vulnerability can be exploited remotely by sending a crafted HTTP POST request with an overly long index parameter. This flaw is significant as it could lead to unauthorized memory manipulation, potentially allowing for arbitrary code execution.

Impact

Exploitation of this vulnerability causes a stack-based buffer overflow, which can lead to memory corruption and arbitrary code execution.

Reproduction

To reproduce this vulnerability, send a crafted HTTP POST request to the /goform/WifiMacFilterGet endpoint. The request must include an excessively long string in the index parameter. This can be done using a tool like Burp Suite or by writing a custom script that automates the process.